I know some people often wonder if an Application Id they see in logs is a first-party Microsoft app, I wrote this KQL to pull down the list of apps from the MS Learn doc itself and create a table from it, so you can then query it and join to it etc - https://t.co/x9MfCefuHF
Regex: when you want to match some characters, but not too many characters, but also maybe some other characters, but not those characters, unless they're followed by these other characters... you know what, never mind, let's just use brute force. 🤯🤯🤯
Log parsing is the process of analyzing and extracting relevant information from log data. It is a critical component of security monitoring and threat detection.
The choice of parsing method depends on the specific use case, the types of data being analyzed. You need all of the above available to engineers to quickly and effectively get data in front of your analysts
🔍 My ultimate workflow for simple and easy JavaScript Analysis
⚡️ Comprehensive JavaScript analysis in offensive security, appsec testing, and red teaming wins.
Often you can find juicy hidden endpoints, parameters, & domains buried JS!
A thread 🧵 1/x
👇